Obfuscated ClickFix Powershell Command

Benjamin Zulliger@benscha

•updated Oct 16, 2025•11•1•435

This rule detects instances where 'powershell.exe', 'pwsh.exe', or 'conhost.exe' are launched by 'explorer.exe' with a command line containing an unusual number of spaces or tabs. This pattern can indicate obfuscation attempts often used by adversaries to hide malicious commands or scripts.